PT-2018-13014 · Cisco · Cisco Unified Communications Manager+3

Published 2018-10-05 · Updated 2019-10-09 · CVE-2018-15403

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco Emergency Responder (affected versions not specified) Cisco Unified Communications Manager (affected versions not specified) Cisco Unified Communications Manager IM & Presence Service (affected versions not specified) Cisco Unity Connection (affected versions not specified)

Description The issue is related to improper input validation of HTTP request parameters, allowing an authenticated, remote attacker to redirect users to a malicious web page through an open redirect attack. This can be used in phishing attacks to trick users into visiting malicious sites.

Recommendations For Cisco Emergency Responder, update to a version that fixes the improper input validation issue. For Cisco Unified Communications Manager, update to a version that fixes the improper input validation issue. For Cisco Unified Communications Manager IM & Presence Service, update to a version that fixes the improper input validation issue. For Cisco Unity Connection, update to a version that fixes the improper input validation issue.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2018-15403

Affected Products

Cisco Emergency Responder

Cisco Unified Communications Manager

Cisco Unified Communications Manager Im & Presence Service

Cisco Unity Connection

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-15403 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-er-ucm-redirect · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-15403 · Vendor Advisory
• http://securitytracker.com/id/1041789 · Note
• http://securitytracker.com/id/1041780 · Note